Analysis
-
max time kernel
93s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 07:41
Behavioral task
behavioral1
Sample
101a7900692d799fcf616f8dae4219924c844f5516798ee331f1f91d146a5f11.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
101a7900692d799fcf616f8dae4219924c844f5516798ee331f1f91d146a5f11.exe
Resource
win10v2004-20241007-en
General
-
Target
101a7900692d799fcf616f8dae4219924c844f5516798ee331f1f91d146a5f11.exe
-
Size
168KB
-
MD5
95a5ccbd6c212b96faba1660f7b2fc5e
-
SHA1
bb1cd0f562332ec6e8e515fbfa0dc78c1f73c154
-
SHA256
101a7900692d799fcf616f8dae4219924c844f5516798ee331f1f91d146a5f11
-
SHA512
e56a4eecdd2e2fb803b829347036433ca70afb00f45e196064ba77a679300a08df277ef5b340fd48709ef0a12c4326ac6dc1972e289ab2425f88694b433a574d
-
SSDEEP
3072:77psu29X3q09JMhQ3KoGIdTocCaLwe7cyJguXQPkbu:7KTfHMhQ71dToc/7cwV
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 101a7900692d799fcf616f8dae4219924c844f5516798ee331f1f91d146a5f11.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4832 101a7900692d799fcf616f8dae4219924c844f5516798ee331f1f91d146a5f11.exe 4832 101a7900692d799fcf616f8dae4219924c844f5516798ee331f1f91d146a5f11.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\101a7900692d799fcf616f8dae4219924c844f5516798ee331f1f91d146a5f11.exe"C:\Users\Admin\AppData\Local\Temp\101a7900692d799fcf616f8dae4219924c844f5516798ee331f1f91d146a5f11.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4832